rehor/docker-compose.yml at master · OpenShift-Fleet/rehor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
services:
  postgres:
    image: pgvector/pgvector:pg17
    environment:
      POSTGRES_DB: bot_memory
      POSTGRES_USER: bot
      POSTGRES_PASSWORD: bot
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bot -d bot_memory"]
      interval: 5s
      retries: 5
    networks:
      - internal

  memory-server:
    build:
      context: .
      dockerfile: memory-server/Dockerfile
    ports:
      - "8080:8080"
    env_file:
      - .env
    environment:
      DATABASE_URL: postgresql://bot:bot@postgres:5432/bot_memory
      TRUSTED_BOT_ACCOUNTS: "${TRUSTED_BOT_ACCOUNTS:-}"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8080/health')\""]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 120s
    networks:
      - internal
      - external  # Needs internet for pip install at startup

  proxy:
    build:
      context: ./proxy
    env_file:
      - .env
    environment:
      - GH_TOKEN
      - GITLAB_TOKEN
      - GH_USERNAME
      - GL_USERNAME
      - GPG_PRIVATE_KEY_B64
      - GOOGLE_SA_KEY_B64
      - GCP_PROJECT_ID=${ANTHROPIC_VERTEX_PROJECT_ID:-}
      - GCP_REGION=${VERTEX_LOCATION:-us-east5}
      - VERTEX_ALLOWED_MODELS=${VERTEX_ALLOWED_MODELS:-}
      - JIRA_URL=${JIRA_URL:-https://redhat.atlassian.net}
      - JIRA_USERNAME
      - JIRA_API_TOKEN
    volumes:
      - executor-sock:/var/run/devbot
    healthcheck:
      test: ["CMD-SHELL", "squidclient -h 127.0.0.1 -p 3128 mgr:info > /dev/null 2>&1 || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - internal
      - external

  bot:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        GOVERSIONS: "1.24.2 1.25.7"
    security_opt:
      - no-new-privileges
    shm_size: 512m
    mem_limit: 8g
    cpus: 4
    pids_limit: 500
    env_file:
      - .env
    volumes:
      - executor-sock:/var/run/devbot
    environment:
      - GH_USER_NAME
      - GH_USER_EMAIL
      - GL_USER_NAME
      - GL_USER_EMAIL
      - SSO_USERNAME
      - SSO_PASSWORD
      - BOT_LABEL=${BOT_LABEL:-hcc-ai-framework}
      - BOT_INSTANCE_ID=${BOT_INSTANCE_ID:-}
      - BOT_CONFIG_REPO=${BOT_CONFIG_REPO:-https://github.com/RedHatInsights/platform-frontend-ai-dev}
      - BOT_CONFIG_PATH=${BOT_CONFIG_PATH:-rehor-config}
      - BOT_MEMORY_URL=http://memory-server:8080/mcp
      - COSTS_API_URL=http://memory-server:8080/api/costs
      - BOT_DASHBOARD_URL=http://memory-server:8080/api/bot-status
      - CLAUDE_CODE_SKIP_VERTEX_AUTH=true
      - ANTHROPIC_VERTEX_BASE_URL=http://proxy:8443
      - ANTHROPIC_VERTEX_PROJECT_ID=${ANTHROPIC_VERTEX_PROJECT_ID:-dummy-project}
      - CLOUD_ML_REGION=global
      # Jira — proxied through proxy container (mcp-atlassian on port 8444)
      - JIRA_MCP_URL=http://proxy:8444/mcp
      # GH release upload — proxied through proxy container (port 8446)
      - GH_RELEASE_UPLOAD_URL=http://proxy:8446/upload
      # Route all HTTP/HTTPS through the Squid proxy
      - HTTP_PROXY=http://proxy:3128
      - HTTPS_PROXY=http://proxy:3128
      - http_proxy=http://proxy:3128
      - https_proxy=http://proxy:3128
      # Internal services bypass the proxy
      - NO_PROXY=memory-server,proxy,postgres,localhost,127.0.0.1,.foo.redhat.com
      - no_proxy=memory-server,proxy,postgres,localhost,127.0.0.1,.foo.redhat.com
    stdin_open: true
    tty: true
    depends_on:
      memory-server:
        condition: service_healthy
      proxy:
        condition: service_healthy
    extra_hosts:
      - "prod.foo.redhat.com:127.0.0.1"
      - "stage.foo.redhat.com:127.0.0.1"
      - "qa.foo.redhat.com:127.0.0.1"
      - "ci.foo.redhat.com:127.0.0.1"
      - "dev.foo.redhat.com:127.0.0.1"
    networks:
      - internal  # No 'external' network — bot can't reach the internet directly

volumes:
  pgdata:
    name: memory-server_pgdata
    external: true
  executor-sock:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: size=1m

networks:
  internal:
    internal: true  # No external gateway — containers can only reach each other
  external:
    driver: bridge  # Normal bridge with internet access — only proxy is on this